Branch trace compression

ABSTRACT

Exemplary methods, apparatuses, and systems generate a plurality of possible branch traces for a computer program. Each possible branch trace represents different sequences of branch instructions that may be executed while the computer program is running. Each branch instruction has a corresponding identifier. A branch trace value is generated for at least one of the plurality of possible branch traces. Generating the branch trace value includes performing a mathematical or logical operation between a first identifier and each subsequent identifier of the possible branch trace to obtain the branch trace value. An output including a branch trace is generated based upon a match between a run-time branch trace value and the at least one generated branch trace value.

FIELD OF THE INVENTION

The various embodiments described herein relate to stack traces andbranch traces. In particular, embodiments relate to compressing a stacktrace or branch trace to efficiently save a context of a point in timeof a computer program.

BACKGROUND OF THE INVENTION

A call stack is a data structure that stores information about theactive functions (subroutines) of a computer program. For example, whena function is called, a combination of one or more of a return address,arguments, and local variable(s) is pushed onto the stack. Uponcompletion of the function, the combination is popped off of the stack.A stack trace is a report of the active stack frames at a point in timeduring the execution of a computer program. A stack trace enables thetracking of the sequence of nested functions called up to the point whenthe stack trace is generated.

Similarly, a branch trace is a report of branch instructions executed ata point in time during the execution of a computer program. In responseto the execution of a branch instruction, the branch instruction addressand/or destination instruction address is saved to memory. A branchtrace enables a more detailed tracking of the sequence of instructionsexecuted up to the point when the branch trace is generated.

The context provided by a stack trace or branch trace at a given pointin a computer program is useful in debugging. For example, a computerprogram may record log messages to provide an audit trail that can beused to understand system activity and to diagnose problems. Logmessages typically do not include calling context beyond the functionfrom which each log message was called. Saving an entire stack trace orbranch trace in log messages is not practical. The log message wouldlose its brevity and writing these messages would be inefficient.Additionally, saving branch traces is costly in terms of memory andexecution speed.

SUMMARY OF THE INVENTION

Exemplary methods, apparatuses, and systems include a compilergenerating a first metadata file including a plurality of possible stacktraces for a computer program. Each possible stack trace representsfunctions that may be active at various points in time while thecomputer program is running. In preparing for execution of the program,a second metadata file including an identifier for each function of thecomputer program is generated. During execution of the computer program,a run-time stack trace value is initialized to zero. For each run-timefunction call and return, the computer program updates the run-timestack trace value to the result of a mathematical or logical operation,such as an exclusive or (XOR) operation, performed on the currentrun-time stack trace value and the function identifier for the called orreturning function. At a given point in time during execution of theprogram, the run-time stack trace value represents a compressed stacktrace. The computer program saves the run-time stack value as part of alog message or other use of a calling context.

A computer utilizes the first and second metadata files and the run-timestack trace value to generate a stack trace for the calling context at apoint in time for a computer program. In generating the stack trace, thecomputer generates a stack trace value for each of the plurality ofpossible stack traces in the first metadata file. Generating the stacktrace value for each possible stack trace includes performing a seriesof one or more mathematical or logical operations between all of thefunction identifiers of the possible stack trace. The computer generatesthe stack trace for a run-time stack trace value as an output based upona match between the saved run-time stack trace value and a generatedstack trace value.

Additional exemplary methods, apparatuses, and systems generate aplurality of possible branch traces for a function of a computerprogram. Each possible branch trace represents different sequences ofbranch instructions that may be executed while the computer program isrunning. Each branch instruction has a corresponding identifier. Abranch trace value is generated for at least one of the plurality ofpossible branch traces. Generating the branch trace value includesperforming a mathematical or logical operation between a firstidentifier and each subsequent identifier of the possible branch traceto obtain the branch trace value. An output including a branch trace isgenerated, e.g., in response to receiving or reading a run-time branchtrace value. The output branch trace is selected based upon a matchbetween the run-time branch trace value and the generated branch tracevalue.

Additional exemplary methods, apparatuses, and systems assign aplurality of branch instructions within a function of a computer programto a plurality of prime numbers. Each branch instruction is assigned toa unique prime number. For example, a first branch instruction isassigned to a first prime number. If a run-time branch trace value isdetermined to be divisible, without a remainder, by the first primenumber, an output is generated indicating that the first branchinstruction was executed. Alternatively, the branch instructions areeach assigned to unique portions of a branch trace array. A run-timebranch trace array is an instance of the branch trace array andrepresents the execution of the computer program up to a point in time.The determination that a portion of a run-time branch trace arrayincludes a non-zero value indicates a corresponding branch instructionwas executed.

Other features and advantages will be apparent from the accompanyingdrawings and from the detailed description.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention is illustrated by way of example and notlimitation in the figures of the accompanying drawings, in which likereferences indicate similar elements, and in which:

FIG. 1 is a flow chart illustrating an exemplary method of generating acompressed stack trace value during run-time of a computer program anddetermining a stack trace based upon the compressed stack trace value;

FIG. 2 illustrates an exemplary computer program to which stack tracecompression is applied;

FIG. 3 is a flow chart illustrating an exemplary method of generatingpossible stack traces for a computer program that includes a functioncall to a library or another computer program;

FIG. 4 illustrates another exemplary computer program to which stacktrace compression is applied;

FIG. 5 is a flow chart illustrating an exemplary method of generatingpossible stack traces for a computer program that includes an indirectfunction call; and

FIG. 6 is a flow chart illustrating an exemplary method of generating acompressed branch trace value during run-time of a computer program anddetermining a branch trace based upon the compressed branch trace value;

FIG. 7 illustrates an exemplary computer program to which branch tracecompression is applied;

FIG. 8 illustrates the exemplary computer program of FIG. 7 in anassembly language;

FIG. 9 illustrates an exemplary object dump of the computer program ofFIG. 8;

FIG. 10 is a flow chart illustrating an alternate method of generating acompressed branch trace value during run-time of a computer program anddetermining a branch trace based upon the compressed branch trace value;

FIG. 11 is a flow chart illustrating another alternate method ofgenerating a compressed branch trace value during run-time of a computerprogram and determining a branch trace based upon the compressed branchtrace value; and

FIG. 12 illustrates, in block diagram form, an exemplary processingsystem to perform one or more features of the method of saving acompressed stack trace value and determining a stack trace based uponthe compressed stack trace value.

DETAILED DESCRIPTION

Embodiments described herein compress a stack trace into a run-timestack trace value. For each run-time function call and return, acomputer program updates the run-time stack trace value to the result ofa mathematical or logical operation performed on the current run-timestack trace value and the function address or other identifier for thecalled or returning function. Corresponding stack trace values aregenerated for possible stack traces for the program. By matching arun-time stack trace value with a corresponding stack trace value, astack trace is identified for the calling context at a point in time fora computer program.

Embodiments described herein also compress a branch trace into arun-time branch trace value. For each run-time branch instructionexecuted, a computer program updates the run-time branch trace value tothe result of mathematical or logical operation performed on the currentrun-time branch trace value and the branch instruction address oranother identifier for the branch instruction. In one embodiment,corresponding branch trace values are generated for possible branchtraces for the program. By matching a run-time branch trace value with acorresponding branch trace value, a branch trace is identified for apoint in time for a computer program (e.g., within a particularfunction). In another embodiment, a list of branch instructions executedduring run-time is determined by inspecting or otherwise manipulatingthe run-time branch trace value.

Saving the context of a stack trace or branch trace provides forenhanced debugging. Saving a compressed stack trace or compressed branchtrace as a single value maintains the brevity of a log message withoutthe performance sacrifice of writing an entire trace. A similar benefitis realized when saving the compressed trace value in a lock datastructure when a lock is acquired or released, e.g., for debugging raceconditions. Compressed stack and branch traces may also be used formemory leak detection, enhanced tracing techniques, etc.

Stack Trace Compression

FIG. 1 is a flow chart illustrating exemplary method 100 of saving acompressed stack trace value and determining a stack trace based uponthe compressed stack trace value. At block 105, a computer generates aplurality of possible stack traces for a computer program. Each stacktrace represents functions that may be active while the computer programis running. For example, during compilation of the computer program, thecomputer may utilize a control-flow or call graph to determine eachcombination of nested functions that would be present in a call stack ateach point of time in the execution of program. Alternatively, thecomputer may use a tool to inspect the computer program's source codeand generate the control-flow graph and determine possible stack traces.In one embodiment, the computer saves the generated plurality of stacktraces in a file, database, or other data structure (referred to hereinas the compiler metadata file). In one embodiment, the computergenerates all possible stack traces for the computer program. In analternate embodiment, the computer generates a subset of the possiblestack traces for the computer program.

FIG. 2 illustrates exemplary computer program 200, to which stack tracecompression may be applied. While FIG. 2 is described with reference toa program written in a compiled programming language, in otherembodiments, stack traces and stack trace values are generated for acomputer program written in an interpreted programming language. Acompiler may generate a control-flow graph of computer program 200 toperform optimizations and otherwise find calling relationships betweenfunctions. In walking through paths in the control-flow graph, thecompiler also generates possible stack traces. For example, during thetraversal of the control-flow graph, assume the current nodes that havealready been traversed are main( ), A( ), and B( ). In this case, thecurrent stack trace that is written into the compiler metadata file is{main, A, B} (representing main( ) at the bottom of the stack and B( )at the top of the stack). The state of this stack trace is reached aseach function is called and/or returned (e.g., in response to “call” or“ret” instructions) as follows: main would have been pushed onto thecall stack, F1( ) would have been pushed onto the call stack, F1( )would be popped off of the call stack when F1( ) returns to main( ), A() would have been pushed onto the call stack (assuming the conditionx==1 is met), F2( ) would have been pushed onto the call stack (assumingthe condition a==0 is met), F2( ) would be popped off of the call stackwhen F2( ) returns to A( ), and B( ) would have been pushed onto thestack. Similarly, the nodes are walked based upon variations of theconditions being met/not met to generate alternate stack traces. Otherpossible stack traces for computer program 200 include {main}, {main,F1}, {main, A}, {main, A, F2}, {main, A, B, C}, and {main, A, D}.

Returning to FIG. 1, at block 110, a computer generates a mapping offunctions to identifiers for each function of the computer program. Inone embodiment, the identifiers are function addresses. As used herein,function addresses correspond to memory address locations into whichfunctions of a computer program are loaded for execution. For example,during or following the loading of the program into memory forexecution, the computer saves the function names and the correspondingfunction addresses into a file, database, or other data structure(referred to herein as the loader metadata file). Computer programs withan executable file are generally loaded at fixed virtual addresses.These addresses may be obtained from the executable file, e.g., in theExecutable and Linkable Format (ELF) header. Dynamically loaded sharedlibraries, however, are loaded at available virtual addresses atrun-time. A loader may be used to obtain the function addresses andgenerate the loader metadata file.

In one embodiment, a single computer performs both the compiling andloading of the program. Alternatively, a first computer compiles theprogram and generates the compiler metadata file while a second computerloads the program and generates the loader metadata file.

A loader metadata file for computer program 200 may include the entriesshown in the following table and which correspond to the illustratedaddresses in FIG. 2.

TABLE 1 Loader Metadata File 0xFFFF1234 main( ) 0xFFFF5678 F1( )0xFFFF9ABC F2( ) 0xFFFFABCD A( ) 0xFFFFEFAB B( ) 0xFFFFCDEF C( )0x0000FDB5 D( )

In an alternate embodiment, the identifier is another unique identifierassigned to each function. For example, each of a sequence of uniquenumbers is mapped to each function in a computer program.

At block 115, the computer initializes a run-time stack trace value tozero during the execution of the computer program. In one embodiment,the computer program is multi-threaded. In such an embodiment, therun-time stack trace value is made an attribute of each thread/processand initialized to zero during thread/process creation.

At block 120, the computer updates the run-time stack trace value foreach function call and function return during execution of the computerprogram. The run-time stack trace value is updated to the result of amathematical or logical operation between the current run-time stacktrace value and the identifier of the function being called orreturning. For example, the computer program obtains the functionaddress for a called function from the program counter or instructionpointer. The computer performs an XOR operation on the obtained functionaddress and the run-time stack trace value and the result is the newvalue for the run-time stack trace value. The computer stores theobtained function address for use again when the function returns. Inone embodiment, call and return instructions are modified to perform theXOR operation (or other mathematical/logical operation) and the computerstores the run-time stack trace value and/or the saved function addressin one or more registers. The computer may quickly execute call andreturn instructions by accessing operands for these operations from thehardware registers. Alternatively, the computer saves the run-time stacktrace value and/or the saved function address in memory, e.g., therun-time stack trace value may be saved in thread-local storage andfunction addresses may be saved at fixed offsets from either the top orbase of each stack frame.

For example, during execution of computer program 200, the computerinitializes the run-time stack trace value to zero (0x00000000). Thefunction addresses in Table 1 above represents the function addressesobtained from the program counter or instruction pointer duringexecution and used by the computer to update the run-time stack tracevalue. When computer program 200 starts executing by calling main( ) thecomputer updates the run-time stack trace value using the functionaddress for main( ), 0xFFFF1234, as follows: run-time stack tracevalue=0x00000000 XOR 0xFFFF1234=0xFFFF1234. When F1( ) is called, thefunction address for F1( ), 0xFFFF5678, is used and the run-time stacktrace value=0xFFFF1234 XOR 0xFFFF5678=0x0000444C.

In one embodiment, the computer saves the function address for eachfunction called. For example, the function address for F1( ) is savedbecause this function address will no longer be easily obtained from theprogram counter or instruction pointer when F1( ) returns. When F1( )returns, the saved function address for F1( ) is retrieved and therun-time stack trace value=0x0000444C XOR 0xFFFF5678=0xFFFF1234. In thisexample, the computer performs an XOR operation with the same functionaddress twice as a result of F1( ) being called and returning. As aresult, the computer updates the run-time stack trace value to eliminatethe effect of the original XOR of the function address for F1( ). Therun-time stack trace value is currently 0xFFFF1234, representing thatonly main( ) remains in the stack.

Assuming the condition (x==1) is met, computer program 200 calls AO andthe run-time stack trace value=0xFFFF1234 XOR 0xFFFFABCD=0x0000B9F9.When F2( ) is called, the run-time stack trace value=0x0000B9F9 XOR0xFFFF9ABC=0xFFFF2345. When F2( ) returns, the function address for F2() is retrieved and the run-time stack trace value returns to itsprevious value, 0xFFFF2345 XOR 0xFFFF9ABC=0x0000B9F9. When BO is called,the run-time stack trace value=0x0000B9F9 XOR 0xFFFFEFAB=0xFFFF5652.When CO is called, the run-time stack trace value=0xFFFF5652 XOR0xFFFFCDEF=0x00009BBD.

The stack trace at this point of execution is represented by {main, A,B, C}. Using a compressed stack trace in the form of the run-time stacktrace value, the single value of 0x00009BBD represents the entire stacktrace. At block 125, the computer writes or otherwise saves a copy ofthe run-time stack trace value to provide the calling context at a pointin time of execution for a log message, lock, etc. For example, computerprogram 200 includes a run-time stack trace value named CombXOR. Thefirst line of computer program 200 configures log messages to be printedas a string preceded by or followed by the run-time stack trace value.Continuing the example above, the log message in CO may print thefollowing log message: [0x00009BBD] Hello world.

If a function is recursive, every other iteration of the functioncalling itself will have the same effect to the run-time stack tracevalue as the function returning when using an XOR operation to updatethe run-time stack trace value. In other words, every even number ofcalls of the same recursive function will result in a run-time stacktrace value equal to the run-time stack trace value prior to the firstcall to the recursive function. Similarly, every odd number of calls ofthe same recursive function will result in a run-time stack trace valueequal to the run-time stack trace following a single call to therecursive function.

In one embodiment in which an XOR operation is used to update therun-time stack trace value, the computer generating the compilermetadata file recognizes a function as being recursive. As a result, thecomputer generates stack traces corresponding to only to zero and oneinstance of each recursive function. Additionally, the computer mayannotate each stack trace with zero or one instance of the recursivefunction as possibly including, respectively, and even or odd number ofrecursive calls to the recursive function.

While the example above is described with reference to an XOR operation,the computer may apply one or more other mathematical or logicaloperations to update the run-time stack trace value. For example, eachtime a function is called, the computer may add the function'sidentifier to the run-time stack trace value. Each time the functionreturns, the computer may subtract the function's identifier from therun-time stack trace value. In yet another embodiment, each time afunction is called, the computer may multiply the function's identifierto the run-time stack trace value, which would begin with an initialvalue of one or another non-zero value. Each time the function returns,the computer may divide the run-time stack trace value by the function'sidentifier.

At block 130, a computer generates stack trace value(s) for at least onepossible stack trace in the compiler metadata file using the functionidentifiers from the loader metadata file. For example, if a firstcomputer compiles the computer program and a second computer loads andexecutes the program, the first computer generated the compiler metadatafile and receives the loader metadata file from the second computer.Alternatively, a second computer generated the loader metadata file andreceives the compiler metadata file from the first computer. In anotherembodiment, a third computer receives the compiler metadata file fromthe first computer and the loader metadata file from the secondcomputer. In yet another embodiment, a single computer generates bothmetadata files.

Similar to the updating of the run-time stack trace value described withreference to block 120, the computer generates stack trace values forpossible stack traces by performing a series of one or more mathematicalor logical operations between the function identifiers of the stacktrace. The following table illustrates the generation of stack tracevalues using an XOR operation for each of the possible stack tracesdescribed above with reference to the compiler and loader metadata filesfor computer program 200. If a possible stack trace includes a singlefunction, the stack trace value is set to the function address for thatfunction.

TABLE 2 Stack Trace Values {main} 0xFFFF1234 {main, F1} 0xFFFF1234 XOR0xFFFF5678 = 0x0000444C {main, A} 0xFFFF1234 XOR 0xFFFFABCD = 0x0000B9F9{main, A, F2} 0xFFFF1234 XOR 0xFFFFABCD XOR 0xFFFF9ABC = 0xFFFF2345{main, A, B} 0xFFFF1234 XOR 0xFFFFABCD XOR 0xFFFFEFAB = 0xFFFF5652{main, A, B, C} 0xFFFF1234 XOR 0xFFFFABCD XOR 0xFFFFEFAB XOR 0xFFFFCDEF= 0x00009BBD {main, A, D} 0xFFFF1234 XOR 0xFFFFABCD XOR 0x0000FDB5 =0x0000444C

In an embodiment that uses a mathematical or logical operation otherthan an XOR operation, the generation of stack trace values for acomputer program that utilizes a recursive function includes detectingthe presence of the recursive function and annotating a stack trace witha number of levels of recursion are involved at a given point in time.In one embodiment, the annotation of a number of levels of recursion islimited to a predetermined maximum value.

At block 135, the computer matches a run-time stack trace value to agenerated stack trace value from the possible stack traces. For example,the computer may use/receive the above-described log message“[0x00009BBD] Hello world.” Using the run-time stack trace value,0x00009BBD, the computer determines that the run-time stack trace valuematches the stack trace value for stack trace {main, A, B, C}.

Different possible stack traces may result in the same stack tracevalue. Referring to the example in Table 2 above, both {main, F1} and{main, A, D} result in the same stack trace value of 0x000444C. When therun-time stack trace value is 0x0000444C, the computer finds twomatching stack traces. In one embodiment, the computer selects amatching stack trace between the two by determining that at least aportion of a log message associated with run-time value matches acommand to print a log message in a top-most function in the stacktrace. For example, assume the log message was “[0x0000444C] Helloearth.” Given that 0x0000444C matches the two stack traces, the computerwill select the stack trace with a top-most function having a command toprint at least a portion of the string “Hello earth.” In this example,we can assume that F1( ) does not include such a string. The computerdetermines that D( ) includes the command LOG(“Hello earth”), which willprint the matching string. As a result, the computer selects the stacktrace {main, A, D} as the calling context matching the log message“[0x0000444C] Hello earth.”

In one embodiment, a log message or lock is executed by the calling ofone or more nested logging/locking functions, e.g., to add the run-timestack trace value to the log message or lock. The calling of a nestedlogging/locking function may alter the value of the run-time stack tracevalue and the nested logging/locking function may be at the top of thestack trace at such a point in time. In such an embodiment, the computerdetermines which stack trace includes a top-most non-nestedlogging/locking function (e.g., at the top, second from the top, etc.)that includes the string of interest.

At block 140, the computer outputs the matching stack trace. Forexample, the computer may output {main, A, B, C} to a display, file,program, etc. to provide the calling context of the log message“[0x00009BBD] Hello world.” In an embodiment in which the callingcontext is provided for a log message in a recursive function, thecomputer may further include the above-described annotation regarding aneven, odd, or explicit/maximum number of calls to the recursivefunction.

FIG. 3 is a flow chart illustrating exemplary method 300 of generatingpossible stack traces for a computer program that includes a functioncall to a library or another computer program. For example, a mainprogram may have a function call to a shared library or an applicationprogramming interface (API) call into another program. In oneembodiment, the main program is compiled separately from the sharedlibrary/other program and linked at a later stage. As a result, each ofthe main program and the shared library/other program will have aseparate compiler metadata file. Method 300 addresses this complicationby generating first and second stack traces for each and concatenatingthe resulting first and second stack traces. Method 300 may be performedas a portion of block 105 described above.

At block 305, the computer determines that a first computer programincludes a function call to a shared library or a second computerprogram. For example, F2( ) of computer program 200 may be a call to ashared library or another computer program. The computer determines thatF2( ) is not defined within computer program 200.

Given that computer program 200 does not define F2( ) at block 310, thecomputer generates a first compiler metadata file including a firststack trace up to the function call to a shared library or secondprogram. At the time the computer calls F2( ) the stack trace is {main,A, F2}. In one embodiment, the computer saves a list of externalfunctions called to a shared library/second program.

At block 315, the computer separately generates a second compilermetadata file, e.g., when compiling the shared library or secondprogram. While generating stack traces for the first program, thecomputer determines that the first program is linked to the sharedlibrary/second program. The computer further determines from the savedlist of external functions for the first program that a function callfrom the first program corresponds to a function to serve as an entrypoint in the shared library/second program. As a result, the computergenerates a stack trace for the second program originating with thematching function. For example, the computer may save F2( ) during thecompilation of computer program 200 and, upon determining that program200 is linked to a shared library and while compiling the sharedlibrary, find a match for the call to F2( ). F2( ) as defined in theshared library, may call one or more functions that are also defined inthe shared library. For example, if F2( ) called F2-1( ), which in turncalled F2-2( ), the computer would generate call stacks for the secondcompiler metadata file with F2 as the entry point: {F2, F2-1}, {F2,F2-1, F2-2}, etc.

At block 320, the computer concatenates a first stack trace from thefirst compiler metadata file with a second stack trace from the secondcompiler metadata file. For example, for every stack trace in the firstcompiler metadata file in which there is a shared library function atthe top of the stack (e.g., {main, A, F2}), the computer generates anaggregated stack trace by merging appropriate stack traces from thesecond compiler metadata file (e.g., {main, A, F2, F2-1}, {main, A, F2,F2-1, F2-2}, etc.). As used herein, the concatenation of stack tracesdoes not create a redundancy of the function that links the firstprogram and the shared library/second program. For example, both thefirst and second compiler metadata files include F2( ) at the respectivetop and bottom of their stack traces. The exemplary first and secondstack traces both include F2 to illustrate that the second stack tracebegins where the first stack trace ends. In performing the concatenationof two stack traces, if F2( ) is found in both the first and secondstack traces, F2( ) is only included once in the concatenated stacktrace. In one embodiment, the redundant function may be omitted fromeither the first stack trace or the second stack trace forconcatenation. In one embodiment, the computer generates the first orsecond stack trace without including the function call to the sharedlibrary or second computer program to avoid having a redundant functionin the stack traces.

In one embodiment, the computer program includes a function call into athird party library. The computer/compiler that compiles the computerprogram may not compile the third party library. Additionally, the thirdparty library may not include stack trace compression features describedherein and may not have a corresponding compiler metadata file. If thecomputer program includes such a third party library call, e.g., for afunction named 3rdp_sharedF, an exemplary stack trace may be {main, A,B, 3rdp_sharedF}. Following the examples above, the run-time stack tracevalue for the stack trace {main, A, B} is 0xFFFF5652. When 3rdp_sharedF() is called from BO, the value of the run-time stack trace value is notchanged—i.e., a mathematical/logical operation is not performed betweenthe run-time stack trace value and the function identifier for3rdp_sharedF( ). Additionally, no matter how many functions3rdp_sharedF( ) calls within the 3rd party shared library, the run-timestack trace value remains unchanged until B( ) calls another function orreturns to A( ).

The computer generates stack trace values for stack traces including athird party library function call in a similar manner. For example, thecomputer generates the same value 0xFFFF5652 for possible stack traces{main, A, B} and {main, A, B, 3rdp_sharedF}. When the computer searchesfor a match between a run-time stack trace value and the generated stacktrace values, the computer will find both stack traces {main, A, B} and{main, A, B, 3rdp_sharedF}.

As described above, the use of a log message may help the computerselect between stack traces with a common stack trace value. Forexample, B( ) may print a log message with the string “Hello mars” afterB( ) calls 3rdp_sharedF( ). When the value 0xFFFF5652 is obtained fromthis log message, the computer will find the two matching stack traces.The computer selects between them by determining that the third partyfunction, 3rdp_sharedF( ), could not have printed a log message with arun-time stack trace value. As a result, the computer selects {main, A,B} as the match. Alternatively, the computer may attempt to find atleast a partial match for a string included in a log message. Given thatany part of the log message string could have been the result of aformatted print statement, the computer searches in the top function forthe entire log message string (excluding the run-time stack trace value)and all substrings thereof. If the computer finds a match for the stringor any substring, the computer selects the corresponding stack trace.For example, the computer may search for sub-strings from the logmessage that are not part of a formatted message. An exemplary message“[0xFFFF5652] Hello 1 mars” is generated by a formatted print statement,such as LOG(“Hello %d mars”, count). In determining the calling contextof this log message, the computer may search in the top functions ofboth possible stack traces for the string “Hello” and/or the string“mars” while eliminating the number from the search.

FIG. 4 illustrates exemplary computer program 400, which includes anindirect function. The function pointer, *fp, is defined in main( ) andused to call the indirect function, (*fp)( ). In one embodiment, thecomputer compiling computer program 400 detects that fp is a variablethat can take the identifier of a function at run-time.

FIG. 5 is a flow chart illustrating exemplary method 500 of generatingpossible stack traces for a computer program that includes an indirectfunction call. At block 505, the computer determines that the programincludes indirect function call. The set of functions to which thefunction pointer resolves at run-time is usually known at compile-time.For example, during compilation, the computer may identify the functionas using a function pointer and functions that may be assigned to thefunction pointer. While the examples of an indirect function describedherein utilize a function pointer, method 500 may generate stack tracesfor other types of indirect functions.

At block 510, the computer generates a first stack trace for thecomputer program up to the indirect function call. For example, thecomputer compiling computer program 400 generates a first stack tracerepresented as {main, fp}.

At block 515, the computer determines a set of one more possiblefunctions that can be assigned to the indirect function call. Forexample, during compilation of computer program 400, the computer keepstrack of assignments to fp, such as fp=A, and fp=B, and saves themapping and/or assigned function names, A and B. In one embodiment, thecomputer adds an annotation, such as “indirect function call<function-names>” next to calls to indirect functions in stack traces inthe compiler metadata file. In the place of <function-names>, thecomputer lists function names that may be assigned to the indirectfunction. For example, the first stack trace above would be modified to{main, fp indirect function call A B}.

At block 520, the computer generates a second stack trace for eachpossible function with the possible function as an entry point for thesecond stack trace. Referring again to computer program 400, thecomputer generates all stack traces corresponding to A( ) and B( ) asentry points: {A}, {A, C}, {B}, and {B, D}.

At block 525, the computer concatenates the first stack trace with eachof the second stack traces. For example, the computer creates stacktraces for computer program 400 by concatenating all stack traces withA( ) and B( ) as an entry point (at the bottom of the stack) and allstack traces that have fp( ) at the top of the stack. In one embodiment,the concatenation includes the computer identifying the “indirectfunction call <function-names>” annotation and replacing the indirectfunction call at the top of the stack in the first stack trace with eachof the second stack traces. The computer would create the followingconcatenated stack traces for computer program 400: {main, A}, {main, A,C}, {main, B}, and {main, B, D}. In an alternate embodiment, theconcatenation includes retaining the “indirect function call<function-names>” annotation and removing the redundant function callfrom the bottom of the second stack trace.

In one embodiment, the computer compiler is not aware of all functionsto which an indirect function pointer resolves. For example, this mayoccur when third party modules (such as 3rd party device drivers) canregister their own functions at run-time for indirect function calls. Insuch cases, as the third party module lacks the compiler metadata fileand ability to update a run-time stack trace value, the run-time stacktrace value computation stops at the call to the third party indirectfunction. When generating the compiler metadata file, the computerannotates the possible stack trace(s) following the point where theindirect function call is made, e.g., with “NO RE-ENTRY” or a similarindication of the third party indirect function call. The resultantrun-time stack trace value that stopped at the third party indirectfunction call may then be matched to a corresponding annotated possiblestack trace.

Branch Trace Compression

FIG. 6 is a flow chart illustrating exemplary method 600 of generating acompressed branch trace value during run-time of a computer program anddetermining a branch trace based upon the compressed branch trace value.As used herein, a branch trace refers to branch instructions executed upto a point in time during execution of a computer program or functionwithin the computer program. Exemplary branch instructions (in acompiled programming language) include conditional “if” statements andloop instructions, such as “for,” “while” and “do-while.”

At block 605, a computer generates a plurality of possible branch tracesfor a function within a computer program. Each branch trace representsdifferent sequences of branch instructions that may be executed whilethe computer program is running. For example, during compilation of thecomputer program, the computer may utilize a control-flow graph todetermine each combination of branch instructions that may be executedwithin each function. Alternatively, the computer may use a tool toinspect the computer program's source code, generate a control-flowgraph, and determine possible branch traces. In one embodiment, thecomputer saves the generated plurality of branch traces in a file,database, or other data structure (referred to herein as the compilermetadata file). In one embodiment, the computer generates a subset ofthe possible branch traces for the computer program for a given compilermetadata file. For example, the computer may generate a compilermetadata file for each of one or more functions of the computer program.In an alternate embodiment, the computer generates all possible stacktraces for the computer program.

FIG. 7 illustrates exemplary function 700 of a computer program to whichbranch trace compression is applied. While FIG. 7 is described withreference to a program written in a compiled programming language, inother embodiments, branch traces and branch trace values are generatedfor a computer program written in an interpreted programming language. Acompiler (or other tool) may generate and use a control-flow graph offunction 700 to perform optimizations and otherwise find possible pathsof execution. In walking through paths in the control-flow graph, thecompiler also generates possible branch traces.

A branch is a sequence of program code that is executed when a conditionis met. For example, upon reaching the “if” statement 705 in line 10 offunction 700, the program may proceed to line 11 if the condition (a==1)is true. Otherwise, function 700 continues with the else statement inline 12 of function 700. If statement 710 and for loop 715 representadditional branch instructions. A control-flow graph for function 700would represent each possible execution path given the three exemplarybranch instructions 705, 710, and 715.

FIG. 8 illustrates exemplary function 800 of the computer program in anassembly language and represented in two columns. Function 800 continuesfrom the bottom of the left column to the top of the right column.Function 800 is the assembly language equivalent of function 700.Function 800 includes three conditional jump commands/branchinstructions 805, 810, and 815 that are equivalent to branchinstructions 705, 710, and 715, respectively. Accordingly, acontrol-flow graph for function 800 would represent each possibleexecution path given the three exemplary branch instructions 805, 810,and 815.

Returning to FIG. 6, at block 610, a computer generates a mapping ofidentifiers to branch instructions. In one embodiment, the identifiersare branch instruction addresses. As used herein, branch instructionaddresses correspond to memory address locations into which branchinstructions within functions of a computer program are loaded forexecution. For example, during or following the loading of the programinto memory for execution, the computer saves the function names and thecorresponding function addresses into a file, database, or other datastructure (referred to herein as the loader metadata file). Computerprograms with an executable file are generally loaded at fixed virtualaddresses. These addresses may be obtained from the executable file,e.g., in the Executable and Linkable Format (ELF) header. Dynamicallyloaded shared libraries, however, are loaded at available virtualaddresses at run-time. A loader may be used to obtain the functionaddresses and generate the loader metadata file. As described above,compiling and loading of the program, and corresponding generation ofcompiler and loader metadata files, may be performed by separatecomputers.

For example, a loader or tool that parses the ELF header determinesfunction 800 has an address of 0x400504. In one embodiment, the computergenerates an object dump of function 800 to determine the address ofeach branch instruction within function 800. As used herein, an objectdump refers to a listing of instructions with corresponding instructionaddress offset values from a function address.

FIG. 9 illustrates exemplary object dump 900 of function 800. Branchinstructions 805, 810, and 815 are shown with offset values 905, 910,and 915, respectively, in object dump 900. For example, the computergenerates object dump 900 using a disassembler or other tool to generatethe listing of instructions with corresponding instruction addressoffset values. Branch instruction 805 has an offset value of 0x27 fromthe beginning of function 800. The address of branch instruction 805,when loaded into memory, is the sum of the address of function 800 andthe offset value for branch instruction 805: 0x400504+0x27=0x40052B.Branch instruction 810 has an offset value of 0x44 from the beginning offunction 800. The address of branch instruction 810 is0x400504+0x44=0x400548. Branch instruction 815 has an offset value of0x6c from the beginning of function 800. The address of branchinstruction 815 is 0x400504+0x6c=0x400570.

Using a loader metadata file to determine the address for function 800,the computer may generate the entries shown in the following table andwhich map branch instruction addresses to corresponding branchinstructions as described above.

TABLE 3 Branch Instruction Addresses 0x40052B 27: 75 0c jne 35 <main +0x35> 0x400548 44: 75 32 jne 78 <main + 0x78> 0x400570 6c: 7e e1 jle 4f<main + 0x4f>

In an alternate embodiment, another identifier is assigned to eachbranch instruction. For example, each of a sequence of unique numbers ismapped to each branch instruction of function 800.

Returning to FIG. 6, at block 615, the computer initializes a run-timebranch trace value to zero during the execution of a given function ofthe computer program. For example, a run-time branch trace value may bemaintained for each function of the computer program. Each time afunction is called, the run-time branch trace value is initialized tozero. In an alternate embodiment, a single run-time branch trace valueis maintained for multiple functions of the computer program. The morefunctions included within a single branch trace, however, the greaterthe likelihood that there will be different branch traces that result inthe same branch trace value.

At block 620, the computer updates the run-time branch trace value eachtime a branch is taken. The run-time branch trace value is updated tothe result of a mathematical or logical operation between the currentrun-time stack trace value and the identifier of the branch instructionbeing executed. For example, the computer program obtains the addressfor branch instruction from the program counter or instruction pointer.The computer performs an XOR, addition, or other mathematical/logicaloperation on the obtained address and the run-time branch trace valueand the result is the new value for the run-time branch trace value.

In one embodiment, branch instructions are modified to perform the XORoperation (or other mathematical/logical operation) and the computerstores the run-time branch trace value in a register. The computer mayquickly execute branch instructions by accessing operands for theseoperations from the hardware registers. Alternatively, the computersaves the run-time branch trace value in memory, e.g., in a localvariable per function or, if the branch trace spans multiple functions,the run-time branch trace value may be saved in thread-local storage.

Referring again to FIG. 8, branch instruction 805 performs a jump to“.L2” when a variable is not equal to 1. In one embodiment, branchinstruction 805 is modified to include an instruction to copy theaddress of the instruction pointer or program counter into a registerprior to the “jne .L2” instruction. Branch instruction 805 is furthermodified to include an instruction to perform the mathematical/logicaloperation between the register storing the copied address and therun-time branch trace value (e.g., stored in another register) followingthe “jne .L2” instruction and prior to printing the string, “Helloworld” in the instruction following branch instruction 805. As a result,the mathematical/logical operation is performed if the branch is taken,e.g., in response to determining “a==1” to be true, as illustrated bybranch instruction 705 in FIG. 7. Similarly, the computer modifiesbranch instruction 810 to copy the branch instruction address prior tothe “jne .L4” instruction and performs the mathematical/logicaloperation between the register storing the copied address and therun-time branch trace value following the “jne .L4” instruction. As aresult, the mathematical/logical operation is performed if the branch istaken, e.g., in response to determining “ptr==NULL” to be true, asillustrated by branch instruction 710 in FIG. 7. The computer alsomodifies branch instruction 815 to copy the branch instruction addressprior to the “jle .L6” instruction and performs the mathematical/logicaloperation between the register storing the copied address and therun-time branch trace value prior to the first instruction in .L6. As aresult, the mathematical/logical operation is performed if the branch istaken, e.g., in response to determining “i<3” to be true, as illustratedby branch instruction 715 in FIG. 7.

Following an exemplary path of execution for function 800, the run-timebranch trace value is initialized to 0 upon entering function 800. Priorto branch instruction 805, the computer stores branch instructionaddress 0x40052B in an address register. The computer follows the branch(“a==1” is true) and performs the mathematical/logical operation betweenthe run-time branch trace value and the instruction address in theaddress register, e.g., run-time branch trace value is updated to theresult of 0 XOR 0x40052B, which is 0x40052B. Function 800 prints thestring, “Hello world.” Function 800 continues to the comparison andcorresponding branch instruction 810. Prior to branch instruction 810,the computer stores branch instruction address 0x400548 in the addressregister. The computer follows the branch (“ptr==NULL” is true) andperforms the mathematical/logical operation between the run-time branchtrace value and the instruction address in the address register, e.g.,run-time branch trace value is updated to the result of 0x40052B XOR0x400548, which is 0x63. Function 800 continues to “.L5” and branchinstruction 815. Prior to branch instruction 815, the computer storesbranch instruction address 0x400570 in the address register. Thevariable “i” is equal to zero and the computer follows the branch (“i<3”is true) and performs the mathematical/logical operation between therun-time branch trace value and the instruction address in the addressregister, e.g., run-time branch trace value is updated to the result of0x63 XOR 0x400570, which is 0x400513. The function continues through“.L6” to increment the value of the variable “i” to 1 and returns tobranch instruction 815. Once again, the computer stores branchinstruction address 0x400570 in the address register. The computerfollows the branch (“i<3” is still true) and performs themathematical/logical operation between the run-time branch trace valueand the instruction address in the address register, e.g., run-timebranch trace value is updated to the result of 0x400513 XOR 0x400570,which is 0x63. This loop is entered again after incrementing “i” to 2.The computer follows the branch (“i<3” is still true) and updates therun-time branch trace value to the result of 0x63 XOR 0x400570, which is0x400513. This loop is not entered again after incrementing “i” to 3.Function 800 continues through the last command and returns.

As illustrated in the loop above, using XOR as the logical operationresults in the run-time branch trace value alternating between one valuefor zero or an even number of iterations of the loop and another valuefor an odd number of iterations of the loop. As a result, acorresponding branch trace including such a loop will represent eitheran odd number of iterations of the loop or zero/an even number ofiterations of the loop. In one embodiment, the computer annotates therun-time branch trace with an indication of an odd or even number ofiterations of a loop at a given point in time. Alternatively, if thecomputer uses addition or another mathematical operation rather thanXOR, each iteration of the loop will be represented in the run-timebranch trace value. The use of a mathematical operation such asaddition, however, includes the possibility of overflow. As a result, inone embodiment, the run-time branch trace value is stored in a registerwith the size of a “long long integer” data type or double the precisionof the size of a pointer data type.

Returning to FIG. 6, at block 625, the computer determines if a functionis called or returned. This determination is performed in parallel withthe updating of the run-time branch trace value in block 620. If thecurrently executing function calls another function, at block 630, thecomputer stores the current run-time branch trace value. In oneembodiment, the current run-time branch trace value is pushed onto thestack during the call for retrieval upon returning to the currentfunction. Method 600 then returns to block 615 and initializes therun-time branch trace value for the new function. The run-time branchtrace value for the new function is updated as described above. Uponreturning to the original function, at block 635, the computer retrievesthe stored run-time branch trace value (e.g., by popping it off of thestack or mapping a returned function to a saved value) and resumesupdating the run-time branch trace value as needed for branchinstructions at block 620.

In the absence of a function call or return, at block 640, the computerwrites the run-time branch trace value to a log message, to a tracebuffer, as a part of a core dump, etc. In one embodiment, the run-timebranch trace value is an invisible local variable added to each functionand is available in each function's call frame on the call stack. Whendebugging a core dump, a debugger or another tool retrieves the run-timebranch trace value for a particular function frame. For example, thedebugger is programmed to read the value from a fixed offset from eitherthe top or bottom of the function call frame. In such an embodiment, thecall frame for that function is popped off the stack when the functionreturns. In one embodiment, to avoid losing run-time branch trace value,the run-time branch trace value is copied to and stored (e.g., in abuffer) before a function frame is popped off the stack (e.g., as partof writing out a trace of invocations of various functions).

At block 645, a computer generates branch trace value(s) for at leastone possible branch trace in the compiler metadata file using theidentifiers from the loader metadata file. For example, if a firstcomputer compiles the computer program and a second computer loads andexecutes the program, the first computer generated the compiler metadatafile and receives the loader metadata file from the second computer.Alternatively, a second computer generated the loader metadata file andreceives the compiler metadata file from the first computer. In anotherembodiment, a third computer receives the compiler metadata file fromthe first computer and the loader metadata file from the secondcomputer. In yet another embodiment, a single computergenerates/receives both metadata files.

Similar to the updating of the run-time branch trace value describedwith reference to block 620, the computer generates branch trace valuesfor possible branch traces by performing a series of one or moremathematical or logical operations between the identifiers of the branchinstructions in the branch trace. If a possible branch trace includes asingle branch instruction, the branch trace value is set to theidentifier for that branch instruction.

At block 650, the computer matches a run-time branch trace value to agenerated branch trace value from the possible branch traces. Forexample, the computer may receive/read a run-time branch trace value of0x40052B written or retained in block 640. Using the run-time branchtrace value, the computer determines that the run-time branch tracevalue matches the branch trace value for a branch trace of function 800that stopped at a point in time following branch instruction 805.Likewise, a run-time branch trace value of 0x63 would match a branchtrace for function 800 stopping after executing branch instruction 810or a branch trace for function 800 after two loops corresponding tobranch instruction 815.

If multiple branch traces produce the same run-time branch trace value,the computer outputs all possible branch traces. In such cases,inspection of the local variable values (e.g., when looking at the stackof a thread) assists in determining if some of the branches could nothave been taken as a result of a local variable value contradicting aknown condition used for a branch instruction.

At block 655, the computer outputs the matching branch trace. Forexample, the computer may output an ordered list of each branchinstruction executed up to a point in time at which the run-time branchtrace value was written. Alternatively, the computer outputs a count ofa number of times each branch instruction was executed.

FIG. 10 illustrates a flow chart illustrating alternate method 1000 ofgenerating a compressed branch trace value during run-time of a computerprogram and determining a branch trace based upon the compressed branchtrace value. At block 1005, a computer assigns each branch instructionof a function to a unique prime number. For example, the computeridentifies each branch instruction from the object code of a functionand assigns prime numbers in ascending order beginning with “2” to theidentified branch instructions. A first branch instruction is assignedto 2, a second branch instruction is assigned to 3, a third branchinstruction is assigned to 5, etc. In another embodiment, differentprime numbers or a different order of prime numbers are assigned to thebranch instructions.

At block 1010, the computer initializes the run-time branch trace valueto one. For example, a run-time branch trace value may be maintained foreach function of the computer program. Each time a function is called,the run-time branch trace value is initialized to one. In an alternateembodiment, a single run-time branch trace value is maintained formultiple functions of the computer program. In one embodiment, therun-time branch trace value is stored as an unsigned long data type.

At block 1015, the computer updates the run-time branch trace value eachtime a branch is taken. The run-time branch trace value is updated tothe result of the prime number assigned to the current branchinstruction multiplied by the branch trace value. Using the exemplaryprime numbers above, if a first branch instruction is taken, therun-time branch trace value is updated to the product of the firstbranch instruction's prime number, 2, and the initial value of therun-time branch trace value, 1. As a result, the updated run-time branchtrace value is 2. If the second branch instruction is taken, therun-time branch trace value is updated again: 3×2=6. If the third branchinstruction is taken, the run-time branch trace value is updated again:6×5=30. If a particular branch instruction were a loop, the run-timebranch trace value may be multiplied by the loop's prime number multipletimes (e.g., for each iteration of the loop).

At block 1020, the computer determines if a function is called orreturned. This determination is performed in parallel with the updatingof the run-time branch trace value in block 1015. If the currentlyexecuting function calls another function, at block 1025, the computerstores the current run-time branch trace value. In one embodiment, thecurrent run-time branch trace value is pushed onto the stack during thecall for retrieval upon returning to the current function. Method 1000then returns to block 1010 and initializes the run-time branch tracevalue for the new function. The run-time branch trace value for the newfunction is updated as described above. Upon returning to the originalfunction, at block 1030, the computer retrieves the stored run-timebranch trace value (e.g., by popping it off of the stack or mapping areturned function to a saved value) and resumes updating the run-timebranch trace value as needed for branch instructions at block 1015.

In the absence of a function call or return, at block 1035, the computerwrites the run-time branch trace value to a log message, to a tracebuffer, as a part of a core dump, etc. In one embodiment, the run-timebranch trace value is an invisible local variable added to each functionand is available in each function's call frame on the call stack. Whendebugging a core dump, a debugger or another tool retrieves the run-timebranch trace value for a particular function frame. For example, thedebugger is programmed to read the value from a fixed offset from eitherthe top or bottom of the function call frame. In such an embodiment, thecall frame for that function is popped off the stack when the functionreturns. In one embodiment, to avoid losing run-time branch trace value,the run-time branch trace value is copied to and stored (e.g., in abuffer) before a function frame is popped off the stack (e.g., for thepurpose of tracing calls to different function invocations).

At block 1040, a computer divides a run-time branch trace value by aprime number to determine if the branch instruction assigned to thatprime number was taken during execution of the function. For example, inresponse to reading or receiving the run-time branch trace value writtenin block 1035, the computer begins attempts to divide prime numbers intothe run-time value to determine branch instructions taken duringrun-time.

At block 1045, the computer determines if the prime number divides intothe run-time branch trace value without a remainder. If not, at block1050, the computer determines that the current prime number was not afactor in reaching the run-time branch trace value and updates thecurrent prime number to the next prime number for another attempt atdivision at block 1040.

If the current prime number divides into the run-time branch trace valuewithout a remainder, at block 1055, the computer updates the run-timebranch trace value to the quotient and increments a counter for thebranch instruction corresponding to the current prime number. Forexample, if the run-time branch trace value is 30 and the first primenumber is 2, the computer determines that 30 is divisible by 2 without aremainder and updates the run-time branch trace value to 30/2=15.Additionally, the first prime number, 2, is assigned to a first branchinstruction, so the computer increments a counter or sets a flagcorresponding to the first branch instruction to indicate that the firstbranch instruction was followed once during execution of the function.In one embodiment, counters are incremented up to, but not beyond, apredetermined maximum value.

At block 1060, the computer determines if the updated run-time branchtrace value is equal to 1. If not, method 1000 returns to block 1040 todetermine if the run-time branch trace value is divisible by the currentprime number again or another prime number. The computer continues todetermine which prime numbers evenly divide into the run-time branchtrace value and increment the corresponding counters until the run-timebranch trace value is updated to a value of 1.

When the updated run-time branch trace value returns to the initialvalue of 1, at block 1065, the computer outputs a list of branches takenwithin the function during run-time according to the counters/flags foreach branch instruction. For example, the counters may indicate a numberof times each of a plurality of branch instructions were executed. Usinga listing of executed branch instructions, a user may at least partiallyreconstruct an order in which instructions were executed in the branchtrace.

FIG. 11 is a flow chart illustrating another alternate method 1100 ofgenerating a compressed branch trace value during run-time of a computerprogram and determining a branch trace based upon the compressed branchtrace value. At block 1105, a computer assigns each branch instructionof a function to a unique portion of a branch trace array. For example,the computer identifies each branch instruction from the object code ofa function and assigns sequential portions of the array to theidentified branch instructions.

At block 1110, the computer initializes each of the array portions to avalue of zero. For example, array values may be maintained for eachfunction of the computer program. Each time a function is called, thearray portions are initialized to zero. In an alternate embodiment, asingle run-time branch trace value is maintained for multiple functionsof the computer program.

At block 1115, for each branch taken during run-time, the computerincrements a corresponding array portion. For example, if a first branchinstruction is assigned to a first portion of the array, upon taking thefirst branch, the computer increments the first portion of the arrayfrom zero to one.

At block 1120, the computer determines if a function is called orreturned. This determination is performed in parallel with theincrementing of array portions in block 1115. If the currently executingfunction calls another function, at block 1125, the computer stores thecurrent array values. In one embodiment, the current array values arepushed onto the stack during the call for retrieval upon returning tothe current function. Method 1100 then returns to block 1110 andinitializes each array portion to zero for the new function. The arrayvalues are incremented in the new function as described above. Uponreturning to the original function, at block 1130, the computerretrieves the stored array values (e.g., by popping them off of thestack mapping a returned function to a saved value) and resumesincrementing the array portions as needed for branch instructions atblock 1115.

In the absence of a function call or return, at block 1135, the computerwrites the array to a log message, to a trace buffer, as a part of acore dump, etc. In one embodiment, the array is added to each functionand is available in each function's call frame on the call stack. Whendebugging a core dump, a debugger or another tool retrieves the arrayfor a particular function frame. For example, the debugger is programmedto read the array from a fixed offset from either the top or bottom ofthe function call frame. In such an embodiment, the call frame for thatfunction is popped off the stack when the function returns. In oneembodiment, to avoid losing run-time branch trace value, the array iscopied to and stored (e.g., in a buffer) before a function frame ispopped off the stack (e.g., for the purpose of tracing calls todifferent function invocations).

At block 1140, in response to receiving a written array, a computeroutputs a list of branches taken within the function during run-timeaccording to array portions assigned to each branch instruction. Forexample, the array portions may indicate a number of times each of aplurality of branch instructions were executed. Using a listing ofexecuted branch instructions, a user may at least partially reconstructan order in which instructions were executed in the branch trace.

FIG. 12 illustrates, in block diagram form, an exemplary processingsystem 1200 to perform one or more features of method of saving acompressed stack trace value and determining a stack trace based uponthe compressed stack trace value. Data processing system 1200 includesone or more microprocessors 1205 and connected system components (e.g.,multiple connected chips). Alternatively, data processing system 1200 isa system on a chip.

Data processing system 1200 includes memory 1210, which is coupled tomicroprocessor(s) 1205. Memory 1210 may be used for storing data,metadata, and programs for execution by the microprocessor(s) 1205.Memory 1210 may include one or more of volatile and non-volatilememories, such as Random Access Memory (“RAM”), Read Only Memory(“ROM”), a solid state disk (“SSD”), Flash, Phase Change Memory (“PCM”),or other types of data storage. Memory 1210 may be internal ordistributed memory.

Data processing system 1200 also includes audio input/output subsystem1215 which may include a microphone and/or a speaker for, for example,playing back music or other audio, receiving voice instructions to beexecuted by microprocessor(s) 1205, playing audio notifications, etc.Display controller and display device 1220 provides a visual userinterface for the user.

Data processing system 1200 also includes one or more input or output(“I/O”) devices and interfaces 1225, which are provided to allow a userto provide input to, receive output from, and otherwise transfer data toand from the system. I/O devices 1225 may include a mouse, keypad or akeyboard, a touch panel or a multi-touch input panel, camera, opticalscanner, network interface, modem, other known I/O devices or acombination of such I/O devices.

I/O devices and interfaces 1225 may also include a port, connector for adock, or a connector for a USB interface, FireWire, Thunderbolt,Ethernet, Fibre Channel, etc. to connect the system 1200 with anotherdevice, external component, or a network. Exemplary I/O devices andinterfaces 1225 also include wireless transceivers, such as an IEEE802.11 transceiver, an infrared transceiver, a Bluetooth transceiver, awireless cellular telephony transceiver (e.g., 2G, 3G, 4G, etc.), oranother wireless protocol to connect data processing system 1200 withanother device, external component, or a network and receive storedinstructions, data, tokens, etc. For example, in an embodiment in whichmultiple processing systems 1200 perform portions of the methodsdescribed herein, data is transferred between processing systems 1200via an I/O device 1225. In one embodiment, one or more of a compilermetadata file, loader metadata file, run-time stack trace value, and logmessage/lock data structure is transmitted and/or received via I/Odevice 1225.

It will be appreciated that one or more buses, may be used tointerconnect the various components shown in FIG. 12.

Data processing system 1200 may be a personal computer, tablet-styledevice, a personal digital assistant (PDA), a cellular telephone withPDA-like functionality, a Wi-Fi based telephone, a handheld computerwhich includes a cellular telephone, a media player, an entertainmentsystem, or devices which combine aspects or functions of these devices,such as a media player combined with a PDA and a cellular telephone inone device. In other embodiments, data processing system 1200 may be anetwork computer, server, or an embedded processing device withinanother device or consumer electronic product. As used herein, the termscomputer, device, system, processing system, processing device, and“apparatus comprising a processing device” may be used interchangeablywith data processing system 1200 and include the above-listed exemplaryembodiments.

It will be appreciated that additional components, not shown, may alsobe part of data processing system 1200, and, in certain embodiments,fewer components than that shown in FIG. 12 may also be used in dataprocessing system 1200. It will be apparent from this description thataspects of the inventions may be embodied, at least in part, insoftware. That is, the computer-implemented method(s) 100, 300, 500,600, 1000, and 1100 may be carried out in one or more computer systemsor other data processing systems 1200 in response to its respectiveprocessor or processing system 1205 executing sequences of instructionscontained in a memory, such as memory 1210 or other non-transitorymachine-readable storage medium. The software may further be transmittedor received over a network (not shown) via network interface device1225. In various embodiments, hardwired circuitry may be used incombination with the software instructions to implement the presentembodiments. Thus, the techniques are not limited to any specificcombination of hardware circuitry and software, or to any particularsource for the instructions executed by data processing system 1200.

An article of manufacture may be used to store program code providing atleast some of the functionality of the embodiments described above.Additionally, an article of manufacture may be used to store programcode created using at least some of the functionality of the embodimentsdescribed above. An article of manufacture that stores program code maybe embodied as, but is not limited to, one or more memories (e.g., oneor more flash memories, random access memories—static, dynamic, orother), optical disks, CD-ROMs, DVD-ROMs, EPROMs, EEPROMs, magnetic oroptical cards or other type of non-transitory machine-readable mediasuitable for storing electronic instructions. Additionally, embodimentsof the invention may be implemented in, but not limited to, hardware orfirmware utilizing an FPGA, ASIC, a processor, a computer, or a computersystem including a network. Modules and components of hardware orsoftware implementations can be divided or combined withoutsignificantly altering embodiments of the invention.

In the foregoing specification, the invention has been described withreference to specific exemplary embodiments thereof. Various embodimentsand aspects of the invention(s) are described with reference to detailsdiscussed herein, and the accompanying drawings illustrate the variousembodiments. The description above and drawings are illustrative of theinvention and are not to be construed as limiting the invention.Numerous specific details are described to provide a thoroughunderstanding of various embodiments of the present invention. However,in certain instances, well-known or conventional details are notdescribed in order to provide a concise discussion of embodiments of thepresent inventions.

It will be evident that various modifications may be made theretowithout departing from the broader spirit and scope of the invention asset forth in the following claims. For example, the methods describedherein may be performed with fewer or more features/blocks or thefeatures/blocks may be performed in differing orders. Additionally, themethods described herein may be repeated or performed in parallel withone another or in parallel with different instances of the same orsimilar methods.

What is claimed is:
 1. A computer-implemented method, comprising:generating a plurality of possible branch traces for a computer program,each possible branch trace representing different sequences of branchinstructions that may be executed while the computer program is running,each branch instruction having a corresponding identifier; determiningan address of a function of the computer program; generating an objectdump including instructions for the function; determining an addressoffset for each branch instruction from the object dump; generating abranch trace value for at least one of the plurality of possible branchtraces, wherein generating the branch trace value includes performing amathematical or logical operation between a first identifier of a firstbranch instruction and each subsequent identifier of branches takenwithin the possible branch trace to obtain the branch trace value;receiving or reading a run-time branch trace value generated while thecomputer program is executed; and generating an output including abranch trace, wherein the output branch trace is selected based upon amatch between the run-time branch trace value and the at least onegenerated branch trace value.
 2. The computer-implemented method ofclaim 1, wherein the mathematical or logical operation is an exclusiveor (XOR) operation.
 3. The computer-implemented method of claim 1,wherein the mathematical or logical operation is an addition operation.4. The computer-implemented method of claim 1, wherein the identifier isan address of each branch instruction.
 5. The computer-implementedmethod of claim 4, further comprising: determining the address of eachbranch instruction generated using the determined address of thefunction and corresponding address offset.
 6. The computer-implementedmethod of claim 1, the generation of the run-time branch trace valuecomprising: initializing the run-time value to zero; and each time abranch instruction is executed during execution of the computer program,performing the mathematical or logical operation between an identifierfor the executed branch instruction and the run-time branch trace valueto update the run-time branch trace value.
 7. The computer-implementedmethod of claim 6, wherein the generation of the run-time branch tracevalue further comprises: saving the run-time branch trace value inresponse to a call of a function; initializing the run-time branch tracevalue to zero for the called function; and restoring the saved run-timebranch trace value in response to a return from the function.
 8. Anon-transitory computer-readable medium storing instructions, which whenexecuted by a processing device, cause the processing device to performmethod comprising: generating a plurality of possible branch traces fora computer program, each possible branch trace representing differentsequences of branch instructions that may be executed while the computerprogram is running, each branch instruction having a correspondingidentifier; determining an address of a function of the computerprogram; generating an object dump including instructions for thefunction; determining an address offset for each branch instruction fromthe object dump; generating a branch trace value for at least one of theplurality of possible branch traces, wherein generating the branch tracevalue includes performing a mathematical or logical operation between afirst identifier of a first branch instruction and each subsequentidentifier of branches taken within the possible branch trace to obtainthe branch trace value; receiving or reading a run-time branch tracevalue generated while the computer program is executed; and generatingan output including a branch trace, wherein the output branch trace isselected based upon a match between the run-time branch trace value andthe at least one generated branch trace value.
 9. The non-transitorycomputer-readable medium of claim 8, wherein the mathematical or logicaloperation is an exclusive or (XOR) operation.
 10. The non-transitorycomputer-readable medium of claim 8, wherein the mathematical or logicaloperation is an addition operation.
 11. The non-transitorycomputer-readable medium of claim 8, wherein the identifier is anaddress of each branch instruction.
 12. The non-transitorycomputer-readable medium of claim 11, further comprising: determiningthe address of each branch instruction generated using the determinedaddress of the function and corresponding address offset.
 13. Thenon-transitory computer-readable medium of claim 8, the generation ofthe run-time branch trace value comprising: initializing the run-timevalue to zero; and each time a branch instruction is executed duringexecution of the computer program, performing the mathematical orlogical operation between an identifier for the executed branchinstruction and the run-time branch trace value to update the run-timebranch trace value.
 14. The non-transitory computer-readable medium ofclaim 13, wherein the generation of the run-time branch trace valuefurther comprises: saving the run-time branch trace value in response toa call of a function; initializing the run-time branch trace value tozero for the called function; and restoring the saved run-time branchtrace value in response to a return from the function.
 15. An apparatuscomprising: a processing device; and a memory coupled to the processingdevice, the memory storing instructions which, when executed by theprocessing device, cause the apparatus to perform a method comprising:generating a plurality of possible branch traces for a computer program,each possible branch trace representing different sequences of branchinstructions that may be executed while the computer program is running,each branch instruction having a corresponding identifier; determiningan address of a function of the computer program; generating an objectdump including instructions for the function; determining an addressoffset for each branch instruction from the object dump; generating abranch trace value for at least one of the plurality of possible branchtraces, wherein generating the branch trace value includes performing amathematical or logical operation between a first identifier of a firstbranch instruction and each subsequent identifier of branches takenwithin the possible branch trace to obtain the branch trace value;receiving or reading a run-time branch trace value generated while thecomputer program is executed; and generating an output including abranch trace, wherein the output branch trace is selected based upon amatch between the run-time branch trace value and the at least onegenerated branch trace value.
 16. The apparatus of claim 15, wherein themathematical or logical operation is an exclusive or (XOR) operation oran addition operation.
 17. The apparatus of claim 15, wherein theidentifier is an address of each branch instruction.
 18. The apparatusof claim 17, the method further comprising: determining the address ofeach branch instruction generated using the determined address of thefunction and corresponding address offset.
 19. The apparatus of claim15, the generation of the run-time branch trace value comprising:initializing the run-time value to zero; and each time a branchinstruction is executed during execution of the computer program,performing the mathematical or logical operation between an identifierfor the executed branch instruction and the run-time branch trace valueto update the run-time branch trace value.
 20. The apparatus of claim19, wherein the generation of the run-time branch trace value furthercomprises: saving the run-time branch trace value in response to a callof a function; initializing the run-time branch trace value to zero forthe called function; and restoring the saved run-time branch trace valuein response to a return from the function.